Go语言中TLS自签名证书的正确实践：解决“未知颁发机构”错误

package main

import (
    "crypto/rand"
    "crypto/rsa"
    "crypto/x509"
    "crypto/x509/pkix"
    "encoding/pem"
    "fmt"
    "math/big"
    "net"
    "os"
    "time"
)

func generateSelfSignedCert() error {
    // 生成RSA私钥
    privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
    if err != nil {
        return fmt.Errorf("failed to generate private key: %w", err)
    }

    // 定义证书模板
    template := x509.Certificate{
        SerialNumber: big.NewInt(1), // 证书序列号
        Subject: pkix.Name{
            Organization: []string{"My Self-Signed CA"},
            CommonName:   "localhost",
        },
        NotBefore: time.Now(),                                      // 证书生效时间
        NotAfter:  time.Now().Add(365 * 24 * time.Hour),            // 证书过期时间（一年）
        KeyUsage:  x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign, // 关键用途，包括签名其他证书
        ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth}, // 扩展关键用途
        BasicConstraintsValid: true,                                // 基本约束有效
        IsCA:                  true,                                // !!! 关键：标记为CA证书
        DNSNames:              []string{"localhost"},               // DNS名称
        IPAddresses:           []net.IP{net.ParseIP("127.0.0.1")}, // IP地址
    }

    // 使用私钥和模板创建自签名证书
    derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
    if err != nil {
        return fmt.Errorf("failed to create certificate: %w", err)
    }

    // 将证书写入cert.pem文件
    certOut, err := os.Create("cert.pem")
    if err != nil {
        return fmt.Errorf("failed to open cert.pem for writing: %w", err)
    }
    defer certOut.Close()
    if err := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
        return fmt.Errorf("failed to write certificate: %w", err)
    }
    fmt.Println("Generated cert.pem")

    // 将私钥写入key.pem文件
    keyOut, err := os.OpenFile("key.pem", os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
    if err != nil {
        return fmt.Errorf("failed to open key.pem for writing: %w", err)
    }
    defer keyOut.Close()
    if err := pem.Encode(keyOut, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey)}); err != nil {
        return fmt.Errorf("failed to write private key: %w", err)
    }
    fmt.Println("Generated key.pem")

    return nil
}

func main() {
    if err := generateSelfSignedCert(); err != nil {
        fmt.Printf("Error generating certificate: %v\n", err)
        os.Exit(1)
    }
}

package main

import (
    "crypto/tls"
    "fmt"
    "io"
    "log"
    "net"
)

func handleConnection(conn net.Conn) {
    defer conn.Close()
    log.Printf("Server: Accepted connection from %s", conn.RemoteAddr())

    // 读取客户端发送的数据并回显
    buf := make([]byte, 512)
    for {
        n, err := conn.Read(buf)
        if err != nil {
            if err != io.EOF {
                log.Printf("Server: Read error: %s", err)
            }
            break
        }
        log.Printf("Server: Received %q", string(buf[:n]))
        if _, err := conn.Write(buf[:n]); err != nil {
            log.Printf("Server: Write error: %s", err)
            break
        }
    }
    log.Printf("Server: Connection from %s closed", conn.RemoteAddr())
}

func main() {
    // 加载服务器证书和私钥
    cert, err := tls.LoadX509KeyPair("./cert.pem", "./key.pem")
    if err != nil {
        log.Fatalf("Server: Failed to load key pair: %s", err)
    }

    // 配置TLS服务器
    config := tls.Config{Certificates: []tls.Certificate{cert}}
    listener, err := tls.Listen("tcp", "127.0.0.1:8000", &config)
    if err != nil {
        log.Fatalf("Server: Failed to listen: %s", err)
    }
    defer listener.Close()
    log.Println("Server: Listening on 127.0.0.1:8000")

    for {
        conn, err := listener.Accept()
        if err != nil {
            log.Printf("Server: Accept error: %s", err)
            break
        }
        go handleConnection(conn)
    }
}

package main

import (
    "crypto/tls"
    "crypto/x509"
    "fmt"
    "io/ioutil"
    "log"
)

func main() {
    // 创建一个新的证书池
    caCertPool := x509.NewCertPool()

    // 读取服务器的公共证书文件
    serverCert, err := ioutil.ReadFile("./cert.pem")
    if err != nil {
        log.Fatalf("Client: Failed to read server certificate: %s", err)
    }

    // 将服务器证书添加到证书池中
    if ok := caCertPool.AppendCertsFromPEM(serverCert); !ok {
        log.Fatalf("Client: Failed to append server certificate to pool")
    }

    // 配置TLS客户端
    config := tls.Config{
        RootCAs: caCertPool, // 客户端信任的根证书池
        // InsecureSkipVerify: true, // 仅在开发测试中用于跳过证书验证，生产环境严禁使用
    }

    // 建立TLS连接
    conn, err := tls.Dial("tcp", "127.0.0.1:8000", &config)
    if err != nil {
        log.Fatalf("Client: Failed to dial: %s", err)
    }
    defer conn.Close()
    log.Println("Client: Connected to 127.0.0.1:8000")

    // 发送数据
    message := "Hello, TLS server!"
    _, err = conn.Write([]byte(message))
    if err != nil {
        log.Fatalf("Client: Failed to write: %s", err)
    }
    log.Printf("Client: Sent: %q", message)

    // 读取服务器响应
    buf := make([]byte, 512)
    n, err := conn.Read(buf)
    if err != nil {
        log.Fatalf("Client: Failed to read: %s", err)
    }
    log.Printf("Client: Received: %q", string(buf[:n]))
}